CVE-2019-0227
Server Side Request Forgery in Apache Axis
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
CVE-2019-0227- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.4 Medium
AV:A/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List No score
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
CVE-2019-0227- Updated
- 2026-11-02
EUVDEUVD-2019-0467 No score
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
EUVD-2019-0467- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h9gj-rqrw-x4fq
Server Side Request Forgery in Apache Axis
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
GHSA-h9gj-rqrw-x4fq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
CVE-2019-0227- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-0227
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
DEBIAN-CVE-2019-0227- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-h9gj-rqrw-x4fq
Server Side Request Forgery in Apache Axis
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
GHSA-h9gj-rqrw-x4fq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-0227
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
- Record
UBUNTU-CVE-2019-0227- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1771459786 No score
TuxCare security update for org.apache.axis:axis (3 CVEs)
TuxCare rebuilt org.apache.axis:axis to address 3 CVEs. Fixed in 1.4-tuxcare.1.
- Record
CLSA-2026-1771459786- Updated
- 2026-11-02
Affected products
- apache axis 1.4
- apache axis
- oracle agile engineering data management
- oracle agile product lifecycle management
- oracle application testing suite
- oracle big data discovery
- oracle communications asap cartridges
- oracle communications design studio
- oracle communications element manager
- oracle communications network integrity
- oracle communications order and service management
- oracle communications session report manager
Show 26 moreShow less
- oracle communications session route manager
- oracle endeca information discovery studio
- oracle enterprise manager base platform
- oracle enterprise manager for fusion middleware
- oracle financial services analytical applications infrastructure
- oracle financial services compliance regulatory reporting
- oracle financial services funds transfer pricing
- oracle flexcube core banking
- oracle flexcube private banking
- oracle hospitality guest access
- oracle instantis enterprisetrack
- oracle internet directory
- oracle knowledge
- oracle peoplesoft enterprise human capital management human resources
- oracle peoplesoft enterprise peopletools
- oracle policy automation connector for siebel
- oracle primavera gateway
- oracle primavera unifier
- oracle rapid planning
- oracle real-time decision server
- oracle retail order broker
- oracle retail xstore point of service
- oracle secure global desktop
- oracle siebel ui framework
- oracle tuxedo
- oracle webcenter portal
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.axis:axisMaven |
through 1.4 | None known |
axis:axisMaven |
through 1.4 | None known |
org.apache.axis:axisTuxCare:Maven From an advisory covering 3 CVEs |
1.4 up to 1.4-tuxcare.1 | 1.4-tuxcare.1 |
axisDebian:12 |
All versions, plus listed versions 1.4-281.4-28+deb12u11.4-291.4-30 |
None known |
axisDebian:13 |
All versions, plus listed versions 1.4-291.4-30 |
None known |
axisDebian:14 |
before 1.4-30, plus listed versions 1.4-29 |
1.4-30 |
axis:axisMaven |
through 1.4, plus listed versions 1.01.11.1-beta1.21.2-RC1 Show 7 moreShow less1.2-RC21.2-RC31.2-alpha-11.2-beta-21.2-beta-31.2.11.3 |
None known |
axisUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.4-221.4-231.4-241.4-24ubuntu0.1~esm1 |
None known |
axisUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4-251.4-25ubuntu0.1~esm1 |
None known |
axisUbuntu:20.04:LTS |
All versions, plus listed versions 1.4-281.4-28+deb10u1build0.20.04.1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
axisUbuntu:22.04:LTS |
All versions, plus listed versions 1.4-281.4-28+deb10u1build0.22.04.1 |
None known |
axisUbuntu:24.04:LTS |
All versions, plus listed versions 1.4-281.4-29 |
None known |
axisUbuntu:25.10 |
All versions, plus listed versions 1.4-29 |
None known |
axisUbuntu:26.10 |
All versions, plus listed versions 1.4-29build1 |
None known |
axisUbuntu:26.04:LTS |
All versions, plus listed versions 1.4-291.4-29build1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Axis 1.4 - Remote Code Execution | 2019-04-09 |
| PoC in GitHub | ianxtianxt/cve-2019-0227 | 2019-10-27 |
| PoC in GitHub | 1475210817/Axis1.4-CVE-2019-0227 | 2026-05-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-0227 is a high vulnerability (CVSS 7.5) in Apache Axis 1.4, published May 1, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 91.9%, the 99th percentile. Fixed in axis 1.4-30.
References
rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis
lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
oracle.com/security-alerts/cpuapr2020.html
Show 14 moreShow less
security.netapp.com/advisory/ntap-20240621-0006
nvd.nist.gov/vuln/detail/CVE-2019-0227
github.com/advisories/GHSA-h9gj-rqrw-x4fq
security-tracker.debian.org/tracker/CVE-2019-0227
ubuntu.com/security/CVE-2019-0227
cve.org/CVERecord?id=CVE-2019-0227